Your designing the access control strategy for a new system that will store highly sensitive...

According to Google Cloud Storage Security documentation, Uniform Bucket-level Access is the industry-standard recommendation for securing sensitive enterprise data. When uniform access is enabled, it disables Access Control Lists (ACLs) entirely, forcing all permissions to be managed via Cloud IAM.

Using IAM roles (such as roles/storage.objectViewer) granted to Google Groups provides several advantages:

Auditability: Every access request is logged with the user's corporate identity in Cloud Audit Logs, meeting the compliance requirement.

Simplicity & Scalability: Permissions are managed in one place (the bucket level) rather than on individual files. As employees join or leave the company, their access is automatically updated by modifying their membership in the Google Group.

Security: It prevents "permissions creep" and accidental exposure that often occurs with fine-grained ACLs (Option D).

Option A (Signed URLs) is over-engineered for internal employee access and harder to audit. Option B is a violation of the Principle of Least Privilege, as objectAdmin allows users to delete and overwrite files, which is inappropriate for financial report viewing.